O, Qualys. 


Qualys Announces Fourth Quarter and Full Year 2018 Financial Results 


2018 Revenue Growth of 21% Year-Over-Year 
Q4 Revenue Growth of 18% Year-Over-Year 
2018 GAAP EPS: $1.37; 2018 Non-GAAP EPS: $1.75 
Q4 GAAP EPS: $0.35; Q4 Non-GAAP EPS: $0.51 


Foster City, Calif., — Feb. 12, 2019 — Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of cloud- 
based security and compliance solutions, today announced financial results for the fourth quarter and full year 
ended December 31, 2018. For the quarter, the Company reported revenues of $74.2 million, net income under 
United States Generally Accepted Accounting Principles (“U.S. GAAP”) of $14.4 million, non-GAAP net income of 
$21.3 million, Adjusted EBITDA of $29.1 million, GAAP earnings per diluted share of $0.35, and non-GAAP 
earnings per diluted share of $0.51. For the full year ended December 31, 2018, the Company reported revenues of 
$278.9 million, GAAP net income of $57.3 million, non-GAAP net income of $73.4 million, Adjusted EBITDA of 
$112.4 million, GAAP earnings per diluted share of $1.37 and non-GAAP earnings per diluted share of $1.75. 


“We achieved a solid fourth quarter, ending a strong year during which we grew revenues by 21%, produced record 
margins, saw new solutions contribute 20% of bookings and benefited from increased multi-product adoption. We 
delivered an impressive suite of new technology and application components to our Qualys Cloud Platform, 
including our innovative Global IT Asset Inventory application,” said Philippe Courtot, chairman and CEO of Qualys. 
“We believe that the scalability, accuracy, immediacy and breadth of our Qualys Cloud Platform continues to enable 
organizations across the globe to build security into their digital transformation initiatives as well as to consolidate 
their IT, security and compliance stacks.” 


Fourth Quarter 2018 Financial Highlights 


Revenues: Revenues for the fourth quarter of 2018 increased by 18% to $74.2 million compared to $62.9 million 
for the same quarter in 2017. 


Gross Profit: GAAP gross profit for the fourth quarter of 2018 increased by 17% to $56.7 million compared to 
$48.5 million for the same quarter in 2017. GAAP gross margin percentage was 76% for the fourth quarter of 2018 
compared to 77% for the same quarter in 2017. Non-GAAP gross profit for the fourth quarter of 2018 increased by 
18% to $58.6 million compared to $49.5 million for the same quarter in 2017. Non-GAAP gross margin percentage 
was 79% for the fourth quarter of 2018 compared to 79% for the same quarter in 2017. 


Operating Income: GAAP operating income for the fourth quarter of 2018 increased by 33% to $12.9 million 
compared to $9.7 million for the same quarter in 2017. As a percentage of revenues, GAAP operating income was 
17% for the fourth quarter of 2018 compared to 15% for the same quarter in 2017. Non-GAAP operating income for 
the fourth quarter of 2018 increased by 22% to $22.8 million compared to $18.7 million for the same quarter in 
2017. As a percentage of revenues, non-GAAP operating income was 31% for the fourth quarter of 2018 compared 
to 30% for the same quarter in 2017. 


Net Income: GAAP net income for the fourth quarter of 2018 was $14.4 million, or $0.35 per diluted share, 
compared to $2.9 million, or $0.07 per diluted share, for the same quarter in 2017. Non-GAAP net income for the 


fourth quarter of 2018 was $21.3 million, or $0.51 per diluted share, compared to non-GAAP net income of $13.0 
million, or $0.32 per diluted share, for the same quarter in 2017. Non-GAAP net income benefited from a $2.3 
million true-up of the non-GAAP tax rate; without this benefit, non-GAAP net income for the fourth quarter of 2018 
would have been $19.0 million, or $0.46 per diluted share. 


Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for the fourth quarter of 2018 increased by 
22% to $29.1 million compared to $23.8 million for the same quarter in 2017. As a percentage of revenues, 
Adjusted EBITDA was 39% for the fourth quarter of 2018 compared to 38% for the same quarter in 2017. 


Operating Cash Flow: Operating cash flow for the fourth quarter of 2018 increased by 3% to $26.7 million 
compared to $25.9 million for the same quarter in 2017. As a percentage of revenues, operating cash flow was 36% 
for the fourth quarter of 2018 compared to 41% for the same quarter in 2017. 


Adoption of the new revenue recognition standard (ASC 606): As a result of adopting ASC 606 on January 1, 
2018, the company capitalizes commission expenses relating to new and upsell business as contract acquisition 
costs, and amortizes the expense over 5 years. Without the adoption of ASC 606, commission expenses would 
have been $1.0 million higher in the fourth quarter of 2018. 


Fourth Quarter 2018 Business Highlights 


Select New Customers: 
e Banco Santander Spain, Castlight Health, Cathay Pacific, Children’s Hospital Colorado, Databricks, Dyson 
Ltd., Kering, Old Mutual South Africa, Owens & Minor, Inc., Post Holdings, Shoprite Holdings, State of Kansas, 
Wind Tre S.p.A. 


Business Highlights: 

e Launched the Qualys Container Security solution on the new AWS Marketplace for Containers, enabling 
customers to gain visibility and security of containerized applications running on Amazon Web Services 
(AWS), in just a few clicks. 

e Announced an integration with AWS Security Hub, which provides Qualys vulnerability and policy compliance 
findings within AWS Security Hub, allowing users to prioritize risks and automate remediation using native 
services such as AWS Lambda. 


Full Year 2018 Financial Highlights 
Revenues: Revenues for 2018 increased by 21% to $278.9 million compared to $230.8 million for 2017. 


Gross Profit: GAAP gross profit for 2018 increased by 19% to $212.7 million compared to $179.2 million for 2017. 
GAAP gross margin percentage was 76% for 2018 compared to 78% for 2017. Non-GAAP gross profit increased by 
20% to $218.8 million for 2018 compared to $181.9 million for 2017. Non-GAAP gross margin percentage was 78% 
for 2018 compared to 79% for 2017. 


Operating Income: GAAP operating income for 2018 was $50.4 million compared to $37.2 million for 2017. Non- 
GAAP operating income for 2018 was $87.2 million compared to $65.0 million for 2017. 


Net Income: GAAP net income for 2018 was $57.3 million, or $1.37 per diluted share, compared to $40.4 million, 
or $1.01 per diluted share, for 2017. Non-GAAP net income for 2018 was $73.4 million, or $1.75 per diluted share, 
compared to non-GAAP net income of $43.7 million, or $1.09 per diluted share, for 2017. 


Adjusted EBITDA: Adjusted EBITDA (a non-GAAP financial measure) for 2018 increased by 32% to $112.4 million 
compared to $84.9 million for 2017. As a percentage of revenues, Adjusted EBITDA was 40% for 2018 compared to 
37% for 2017. 


Operating Cash Flow: Operating cash flow for 2018 was $125.5 million compared to $107.6 million for 2017. As a 
percentage of revenues, operating cash flow was 45% in 2018 compared to 47% in 2017. 


Additional Full Year 2018 Business Highlights 


Market Recognition 
e Recognized by IDC for the third year in a row as the market-share leader in the $2.0 billion Worldwide 
Vulnerability Assessment Market, and as having the fifth largest market share in the $6.7 billion Worldwide 
Security and Vulnerability Management market. 


Products & Features 
e Launched disruptive new solutions and features: 

— Asset Inventory (Al): a new Cloud App with capabilities that provide customers a single ‘source of truth’ for 
IT assets spread across hybrid environments including on-premises assets, endpoints and clouds, with 
synchronization capabilities to Configuration Management Databases (CMDBs) to keep asset data up-to- 
date. 

— Qualys Container Security (CS): A new Cloud App that enables customers to build continuous security into 
their global container deployments and DevOps processes at any scale, and to integrate the results into 
one unified view of their global hybrid IT security and compliance posture, breaking down silos and lowering 
ownership cost. 

— Cloud Inventory (Cl) and Cloud Security Assessment (CSA): New Cloud Apps that deliver continuous 
visibility into public cloud accounts and provide an assessment of the security posture of an organization’s 
cloud resources against misconfigurations, malicious behavior, and nonstandard deployments. 

— Certificate Inventory (CRI) and Certificate Assessment (CRA): CRI continuously scans global IT assets 
from a single console to discover internal and external certificates issued from any certificate authority 
across all enterprise IT assets, both on premises and in clouds. CRA assesses certificates and underlying 
SSL/TLS configurations and vulnerabilities across global IT assets to prevent downtime and outages, and 
mitigate risks from expired or vulnerable SSL/TLS certificates and configurations. 

— Web Application Scanning (WAS) 6.0: A new integration with Jenkins, Swagger and a new Chrome 
Browser Recorder extension further automate web application scanning in DevOps, and streamline REST 
API testing to help teams automate and operationalize global DevSecOps throughout the Software 
Development Lifecycle (SDLC). 

— Out-of-Band Configuration Assessment (OCA): a sensor and Cloud App that allows customers to achieve 
complete visibility of all Known IT infrastructure by pushing vulnerability and configuration data to the 
Qualys Cloud Platform from systems that are otherwise difficult or impossible to assess. 

— Passive Network Sensor (PNS): a new member of the Qualys sensor family that natively integrates network 
analysis functions into the Qualys Cloud Platform, delivering customers complete IT visibility at scale, while 
drastically reducing cost and complexity. Currently in beta. 

— New Cloud Security Assessment features for monitoring and assessment for the Center for Internet 
Security, Inc. (CIS) Microsoft Azure Foundations Benchmark. 

— New functionality in our Security Assessment Questionnaire (SAQ) Cloud App that allows customers to 
better achieve visibility of data across their own network and supply chain for compliance with the European 
Union’s General Data Protection Regulation (GDPR). 

e Introduced the Qualys Consulting Edition, a comprehensive offering for consultants, security consulting 
organizations and managed service providers (MSPs) that brings them the power and scale of the Qualys 

Cloud Platform in an easy-to-deploy, easy-to-use and cost-effective solution. 


Delivered three new free groundbreaking solutions: 
— CertView, which helps customers inventory and assess certificates and underlying SSL/TLS configurations 


and vulnerabilities across external-facing assets to prevent downtime and outages, and to mitigate risks 
associated with expired or vulnerable SSL/TLS certificates and configurations. 

CloudView, which delivers customers topological visibility and insight about the security and compliance 
posture of their public cloud infrastructure for major providers including AWS, Microsoft Azure and Google 
Cloud. 

Qualys Community Edition, which gives small organizations unified visibility of their own or their clients’ IT 
and web assets, allowing users to leverage the Qualys Cloud Platform to automatically gather and analyze 


security and compliance data from hybrid IT environments. 

Accelerated technology roadmap with key acquisitions and investments: 

— Acquired the software assets of 1Mobility, Singapore, allowing Qualys to provide enterprises the ability to 
inventory and assess mobile devices, and quarantine compromised or out-of-compliance devices. It also 
allows Qualys to extend its PCI certification to mobile devices and to deliver a highly scalable Enterprise 
Mobility Management (EMM) solution. 

— Acquired container-native security company Layered Insight, enabling Qualys to add runtime defense 
capabilities and automated enforcement to its current Container Security solution, and to automatically 
correlate deep runtime behavioral analysis with Qualys’ leading threat protection capabilities — delivering 
DevOps teams high runtime application protection without added container management complexity. 

— Purchased a minority stake in 42Crunch Ltd. as the first Qualys venture investment and simultaneously 
signed a distribution agreement. 42Crunch has developed an API security platform enabling organizations 
to quickly deliver applications built on secure APIs. 


Business Development 


Provided an integration with the Cloud Security Command Center (Cloud SCC) for Google Cloud Platform 


(GCP), providing security teams a single pane for security features, policies, and insights across Google Cloud 


platform, and adding vulnerability management and threat data for compute engine instances within a GCP 
project. 

Delivered an integration with Illumio's solutions to deliver the industry's first vulnerability-based micro- 
segmentation, which enables organizations to visualize vulnerabilities across data centers and clouds through 
a real-time global vulnerability map. 

Expanded our partnership under which Carahsoft will proactively market, sell and distribute the FedRAMP- 
authorized Qualys Gov Platform to federal agencies as well as state and local governments. 

Deepened the existing relationship with IBM X-Force Red to leverage the Qualys Cloud Platform as part of its 
Vulnerability Management Services (VMS), deploying the Qualys Cloud Agent and Qualys Cloud Apps into 
client environments as part of a programmatic vulnerability management approach to identify, prioritize and 
remediate clients’ most critical vulnerabilities. 

Announced a new integration with Microsoft Azure Stack that provides a single-pane view of the security and 
compliance posture of Microsoft Azure infrastructure and user workloads, allowing Azure customers to assess 
the vulnerability and compliance posture of Azure Stack’s control plane infrastructure, and get the advisory 
published by Microsoft Azure. 

Announced a joint solution, the Healthcare Cloud Security Stack (HCSS) for Microsoft Azure, which allows 
healthcare entities to build security into their data-driven healthcare decision-making applications as they 
migrate workloads to the cloud. 


Financial Performance Outlook 


First Quarter 2019 Guidance: Management expects revenues for the first quarter of 2019 to be in the range of 
$74.5 million to $75.2 million, representing 15% to 16% growth over the same quarter in 2018. GAAP net income 
per diluted share is expected to be in the range of $0.16 to $0.18, which assumes an effective income tax rate of 
26%. Non-GAAP net income per diluted share is expected to be in the range of $0.41 to $0.43, which assumes an 
effective non-GAAP income tax rate of 22%. First quarter 2019 earnings per share estimates are based on 
approximately 41.6 million weighted average diluted shares outstanding for the quarter. 


Full Year 2019 Guidance: Management expects revenues for the full year 2019 to be in the range of $320.0 million 
to $323.0 million, representing 15% to 16% growth over 2018. GAAP net income per diluted share is expected to be 
in the range of $0.90 to $0.95, which assumes an effective income tax rate of 26%. Non-GAAP net income per 
diluted share is expected to be in the range of $1.84 to $1.89, which assumes an effective non-GAAP income tax 
rate of 22%. Full year 2019 earnings per share estimates are based on approximately 42.1 million weighted 
average diluted shares outstanding. 


Investor Conference Call 


Qualys will host a conference call and live webcast to discuss its fourth quarter and full year 2018 financial results 
at 5:00 p.m. Eastern Time (2:00 p.m. Pacific Time) on Tuesday, Feb. 12, 2019. To access the conference call, dial 
(877) 881-2609 in the U.S. or (970) 315-0463 for international participants with conference ID # 2274058. The live 
webcast of Qualys’ earnings conference call, investor presentation, and prepared remarks can also be accessed at 
https://investor.qualys.com/events.cfm. A replay of the conference call will be available through the same webcast 
link following the end of the call. 


Investor Contact 


Natasha Asar 
Investor Relations 
(650) 801-6172 


ir@qualys.com 
About Qualys, Inc. 


Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of cloud-based security and compliance solutions 
with over 12,200 customers and active users in more than 130 countries, including a majority of each of the Forbes 
Global 100 and Fortune 100. Qualys helps organizations streamline and consolidate their security and compliance 
solutions in a single platform and build security into digital transformation initiatives for greater agility, better 
business outcomes and substantial cost savings. The Qualys Cloud Platform and its integrated Cloud Apps deliver 
businesses critical security intelligence continuously, enabling them to automate the full spectrum of auditing, 
compliance and protection for IT systems and web applications on premises, on endpoints and elastic clouds. 
Founded in 1999 as one of the first SaaS security companies, Qualys has established strategic partnerships with 
leading managed service providers and consulting organizations including Accenture, BT, Cognizant Technology 
Solutions, Deutsche Telekom, DXC Technology, Fujitsu, HCL Technologies, IBM, Infosys, NTT, Optiv, 
SecureWorks, Tata Communications, Verizon and Wipro. The company is also a founding member of the Cloud 
Security Alliance. For more information, please visit www.qualys.com. 


Qualys and the Qualys logo are proprietary trademarks of Qualys, Inc. All other products or names may be 
trademarks of their respective companies. 


Legal Notice Regarding Forward-Looking Statements 


This press release contains forward-looking statements within the meaning of Section 27A of the Securities Act of 
1933 and Section 21E of the Securities Exchange Act of 1934. Forward-looking statements generally relate to 
future events or our future financial or operating performance. Forward-looking statements in this press release 
include, but are not limited to, statements related to: our expectations regarding our suite of new technology and 
application components added to our Qualys Cloud Platform; our expectations regarding our IT asset management 
application; the capabilities of our platform; the related benefits of our strategic acquisitions; the related benefits of 
our new products, integrations, collaborations and joint solutions; our strategy and our business model and our 
ability to execute such strategy; our guidance for revenues, GAAP EPS and non-GAAP EPS for the first quarter and 
full year 2019, and our expectations for the number of weighted average diluted shares outstanding and effective 
income tax rate for the first quarter and full year 2019. Our expectations and beliefs regarding these matters may 
not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual 
results to differ materially from those projected. These risks include our ability to continue to develop platform 
capabilities and solutions; the ability of our platform and solutions to perform as intended; customer acceptance and 
purchase of our existing solutions and new solutions; real or perceived defects, errors or vulnerabilities in our 
products or services; our ability to retain existing customers and generate new customers; the budgeting cycles, 
seasonal buying patterns and length of our sales cycle; our ability to manage costs as we increase our customer 
base and the number of our platform solutions; the market for cloud solutions for IT security and compliance not 
increasing at the rate we expect; competition from other products and services; fluctuations in currency exchange 
rates, unexpected fluctuations in our effective tax rate on a GAAP and non-GAAP basis, our ability to effectively 
manage our rapid growth and our ability to anticipate future market needs and opportunities; any unanticipated 
accounting charges; and general market, political, economic and business conditions in the United States as well as 
globally. The forward-looking statements contained in this press release are also subject to other risks and 
uncertainties, including those more fully described in our filings with the Securities and Exchange Commission, 
including our Quarterly Report on Form 10-Q for the quarter ended September 30, 2018, filed with the Securities 
and Exchange Commission on November 5, 2018. 


The forward-looking statements in this press release are based on information available to Qualys as of the date 
hereof, and Qualys disclaims any obligation to update any forward-looking statements, except as required by law. 


Non-GAAP Financial Measures 


In addition to reporting financial results in accordance with generally accepted accounting principles, or GAAP, 
Qualys monitors operating measures of non-GAAP gross profit, non-GAAP gross margin, non-GAAP operating 
expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per diluted share and 
Adjusted EBITDA. In computing these non-GAAP financial measures, Qualys excludes the effects of stock-based 
compensation expense, non-recurring expenses and cash acquisition-related expenses that do not reflect ongoing 
costs of operating the business. Qualys also monitors Adjusted EBITDA (defined as earnings before interest, taxes, 
depreciation, amortization, stock-based compensation, other (income) expense, net, non-recurring expenses, and 
cash acquisition-related expenses that do not reflect ongoing costs of operating the business). Qualys believes that 
these non-GAAP operating metrics help illustrate underlying trends in its business that could otherwise be masked 
by the effect of the income or expenses, as well as the related tax effects, that are excluded in non-GAAP gross 
profit, non-GAAP gross margin, non-GAAP operating expenses, non-GAAP operating income, non-GAAP net 
income, non-GAAP net income per diluted share and Adjusted EBITDA. 


Furthermore, Qualys uses these operating measures to establish budgets and operational goals for managing its 
business and evaluating its performance. Qualys believes that non-GAAP gross profit, non-GAAP gross margin, 
non-GAAP operating expenses, non-GAAP operating income, non-GAAP net income, non-GAAP net income per 
diluted share, and Adjusted EBITDA provide additional tools for investors to use in comparing its recurring core 


business operating results over multiple periods with other companies in its industry. Non-GAAP net income and 
non-GAAP net income per diluted share for the twelve months ended December 31, 2018 excludes $3.7 million of 
amortization of intangibles from acquisitions of Nemean, Nevis Networks, NetWatcher, 1Mobility and Layered 
Insight and $3.0 million of compensation expense from the acquisition of NetWatcher and Layered Insight that do 
not reflect ongoing costs of operating the business. 


Qualys has not reconciled non-GAAP net income per diluted share guidance to GAAP net income per diluted share 
because Qualys does not provide guidance on the various reconciling cash and non-cash items between GAAP net 
income and non-GAAP net income (i.e., stock-based compensation and non-recurring expenses). The actual dollar 
amount of reconciling items in the first quarter and full year 2019 is likely to have a significant impact on the 
Company’s GAAP net income per diluted share in the first quarter and full year 2019. Accordingly, a reconciliation 
of the non-GAAP net income per diluted share guidance to the GAAP net income per diluted share guidance is not 
available without unreasonable effort. 


In order to provide a more complete picture of recurring core operating business results, the Company’s non-GAAP 
net income and non-GAAP net income per diluted share include tax adjustments required to achieve the effective 
tax rate on a non-GAAP basis, which could differ from the GAAP effective tax rate. The Company believes its 
estimated non-GAAP effective tax rate of 22% in 2019 is a reasonable estimate under its global operating structure. 
The Company may adjust this rate during the year to take into account events or trends that it believes materially 
impact the estimated annual rate. The non-GAAP effective tax rate could be subject to change for a number of 
reasons, including but not limited to, significant changes resulting from tax legislation, material changes in 
geographic mix of revenues and expenses and other significant events. 


The presentation of this non-GAAP financial information is not intended to be considered in isolation or as a 
substitute for results prepared in accordance with GAAP. A reconciliation of the non-GAAP financial measures 
discussed in this press release to the most directly comparable GAAP financial measures is included with the 
financial statements contained in this press release. Management uses both GAAP and non-GAAP information in 
evaluating and operating its business internally and as such has determined that it is important to provide this 
information to investors. 


Qualys, Inc. 

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS 
(Unaudited) 

(in thousands, except per share data) 


Revenues 

Cost of revenues “) 
Gross profit 

Operating expenses: 
Research and development “ 
Sales and marketing “ 
General and administrative 

Total operating expenses 


Income from operations 
Other income, net: 

Interest expense 

Interest income 

Other income (expense), net 

Total other income, net 

Income before income taxes 
(Benefit from) provision for income taxes 
Net income 
Net income per share: 

Basic 


Diluted 


Weighted average shares used in computing net income per share: 


Basic 
Diluted 


“) Includes stock-based compensation as follows: 


Cost of revenues 

Research and development 
Sales and marketing 
General and administrative 


Total stock-based compensation 


Three Months Ended 
December 31, 


Year Ended 
December 31, 


2018 2017 2018 2017 
74,200 $ 62,915 $ 278,889 $ 230,828 
17,525 14,405 66,185 51,580 
56,675 48,510 212,704 179,248 
15,073 11,576 53,255 42,816 
19,341 16,983 70,039 63,855 
9,318 10,222 39,049 35,334 
43,732 38,781 162,343 142,005 
12,943 9,729 50,361 37,243 

(60) = (172) (3) 
1,887 899 6,080 2,674 
35 (247) (801) (536) 
1,862 652 5,107 2,135 
14,805 10,381 55,468 39,378 
405 7,524 (1,836) (1,062) 
14,400 $ 2,857 $ 57,304 $ 40,440 
0.37 0.07 1.47 $ 1.08 
0.35 0.07 1.37 $ 1.01 
39,200 38,278 38,876 37,443 
41,580 41,186 41,897 40,071 
601 $ 590 $ 2,489 $ 2,159 
2,207 1,715 7,961 5,944 
981 1,311 4,650 4,755 
3,629 4,823 14,990 14,103 
7,418 $ 8,439 $ 30,090 $ 26,961 


Qualys, Inc. 
CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE INCOME 
(Unaudited) 
(in thousands) 


Three Months Ended Year Ended 
December 31, December 31, 
2018 2017 2018 2017 
Net income $ 14,400 $ 2,857 $ 57,304 $ 40,440 
Other comprehensive income (loss): 
Available-for-sale marketable securities: 
Change in net unrealized (loss) gain, net of tax 166 (493) (261) (462) 
Reclassification adjustment for net change realized and 


included in net income, net of tax 40 40 289 44 
Total change in unrealized gain (loss) on marketable 
securities, net of tax 206 (453) 28 (418) 
Cash flow hedges: 
Change in net unrealized (loss), net of tax (40) — (40) — 
Other comprehensive income (loss), net of tax 166 (453) (12) (418) 
Comprehensive income $ 14,566 $ 2,404 $ 57,292 $ 40,022 


Qualys, Inc. 


CONDENSED CONSOLIDATED BALANCE SHEETS 


Assets 

Current assets: 
Cash and cash equivalents 
Short-term marketable securities 


Accounts receivable, net 


Prepaid expenses and other current assets 


Total current assets 
Long-term marketable securities 
Property and equipment, net 
Deferred tax assets, net 
Intangible assets, net 
Goodwill 
Long-term investment 
Restricted cash 
Other noncurrent assets 

Total assets 


Liabilities and Stockholders’ Equity 
Current liabilities: 


Accounts payable 
Accrued liabilities 
Deferred revenues, current 
Capital lease, current 
Total current liabilities 
Deferred revenues, noncurrent 
Other noncurrent liabilities 
Total liabilities 
Stockholders’ equity: 
Common stock 
Additional paid-in capital 
Accumulated other comprehensive loss 
Retained earnings 


Total stockholders’ equity 


Total liabilities and stockholders’ equity 


(Unaudited) 


(in thousands) 


December 31, 2018 


December 31, 2017 


$ 41,026 $ 86,591 
248,140 201,823 

75,825 64,412 

13,974 16,524 

378,965 369,350 

76,710 67,224 

61,442 58,557 

26,387 25,066 

21,976 12,401 

7,225 1,549 

2,500 = 

1,200 1,200 

9,275 2,178 

$ 585,680 $ 537,525 
$ 5,588 $ 1,144 
25,130 21,444 

164,624 143,186 

1,565 = 

196,907 165,774 

20,423 17,136 

10,361 11,071 

227,691 193,981 

39 39 

330,572 304,155 

(586) (574) 

27,964 39,924 

357,989 343,544 

$ 585,680 $ 537,525 


Qualys, Inc. 


CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS 


(Unaudited) 
(in thousands) 


Cash flows from operating activities: 
Net income 
Adjustments to reconcile net income to net cash provided by operating activities: 
Depreciation and amortization expense 
Bad debt expense 
Loss on disposal of property and equipment 
Stock-based compensation 
Amortization of premiums and accretion of discounts on marketable securities 
Deferred income taxes 
Changes in operating assets and liabilities: 
Accounts receivable 
Prepaid expenses and other assets 
Accounts payable 
Accrued liabilities 
Deferred revenues 
Other noncurrent liabilities 
Net cash provided by operating activities 
Cash flows from investing activities: 
Purchases of marketable securities 
Sales and maturities of marketable securities 
Purchases of property and equipment 
Business combinations, net of cash acquired 
Purchase of privately-held investment 
Net cash used in investing activities 
Cash flows from financing activities: 
Repurchase of common stock 
Proceeds from exercise of stock options 
Payments for taxes related to employee net share settlement of equity awards 
Principal payments under capital lease obligations 
Net cash (used in) provided by financing activities 
Net decrease in cash, cash equivalents and restricted cash 
Cash, cash equivalents and restricted cash at beginning of period 


Cash, cash equivalents and restricted cash at end of period 


$ 


Year Ended December 31, 


2018 


57,304 $ 


28,904 
86 
9 
30,090 
(1,136) 
(2,521) 


(11,467) 

(4,970) 
3,515 
1,426 
24,725 

(501) 
125,464 


(339,862) 
285,224 
(22,775) 
(13,633) 
(2,500) 
(93,546) 


(85,040) 
24,053 
(14,879) 
(1,617) 
(77,483) 
(45,565) 
87,791 
42,226 $ 


2017 


40,440 


20,636 
657 
161 

26,961 

1,324 
(2,718) 


(17,966) 

(53) 

(454) 
1,485 
29,830 
7,343 
107,646 


(299,891) 
231,996 
(37,818) 
(12,482) 


(118,195) 


31,327 
(20,924) 
10,403 

(146) 
87,937 
87,791 


Qualys, Inc. 


RECONCILIATION OF NON-GAAP DISCLOSURES 


EBITDA AND ADJUSTED EBITDA 


(Unaudited) 
(in thousands) 


Three Months Ended 
December 31, 


2018 
Net income $ 14,400 
Depreciation and amortization of property and equipment 6,316 
Amortization of intangible assets 1,364 
Interest expense 60 
(Benefit from) provision for income taxes 405 
EBITDA 22,545 
Stock-based compensation 7,418 
Other income, net (1,922) 
Cash acquisition-related expense (1) 1,099 
Adjusted EBITDA $ 29,140 


$ 


$ 


2017 
2,857 
5,166 

416 
7,524 
15,963 
8,439 
(652) 
93 
23,843 


$ 


Year Ended 
December 31, 

2018 2017 
57,304 $ 40,440 
25,136 19,828 

3,768 808 

172 3 

(1,836) (1,062) 
84,544 60,017 
30,090 26,961 

(5,279) (2,138) 

3,025 93 

112,380 $ 84,933 


$ 


Note (1): Includes $3.0 million and $0.1 million of compensation related to acquisitions in 2018 and 2017, respectively. 


Qualys, Inc. 
RECONCILIATION OF NON-GAAP DISCLOSURES 
(Unaudited) 
(in thousands, except per share data) 


Three Months Ended Year Ended 
December 31, December 31, 
2018 2017 2018 2017 
GAAP Cost of revenues $ 17,525 $ 14,405 $ 66,185 $ 51,580 
Less: Stock-based compensation (601) (590) (2,489) (2,159) 
Less: Intangible asset amortization (1,339) (374) (3,625) (460) 
Non-GAAP Cost of revenues $ 15,585 $ 13,441 $ 60,071 $ 48,961 
GAAP Gross profit $ 56,675 $ 48,510 $ 212,704 $ 179,248 
Plus: Stock-based compensation 601 590 2,489 2,159 
Plus: Intangible asset amortization 1,339 374 3,625 460 
Non-GAAP Gross profit $ 58,615 $ 49,474 $ 218,818 $ 181,867 
GAAP Research and development $ 15,073 $ 11,576 $ 53,255 $ 42,816 
Less: Stock-based compensation (2,207) (1,715) (7,961) (5,944) 
Less: Cash acquisition-related expense (1) (1,099) (14) (1,223) (14) 
Less: Intangible asset amortization (25) (25) (100) (282) 
Non-GAAP Research and development $ 11,742 $ 9,822 $ 43,971 $ 36,576 
GAAP Sales and marketing $ 19,341 $ 16,983 $ 70,039 $ 63,855 
Less: Stock-based compensation (981) (1,311) (4,650) (4,755) 
Less: Cash acquisition-related expense (1) — (79) (1,802) (79) 
Non-GAAP Sales and marketing $ 18,360 $ 15,593 $ 63,587 $ 59,021 
GAAP General and administrative $ 9,318 $ 10,222 $ 39,049 $ 35,334 
Less: Stock-based compensation (3,629) (4,823) (14,990) (14,103) 
Non-GAAP General and administrative $ 5,689 $ 5,399 $ 24,059 $ 21,231 
GAAP Operating expenses $ 43,732 $ 38,781 $ 162,343 $ 142,005 
Less: Stock-based compensation (6,817) (7,849) (27,601) (24,802) 
Less: Intangible asset amortization (25) (25) (100) (282) 
Less: Cash acquisition-related expense (1) (1,099) (93) (3,025) (93) 
Non-GAAP Operating expenses $ 35,791 $ 30,814 $ 131,617 $ 116,828 
GAAP Income from operations $ 12,943 $ 9,729 $ 50,361 $ 37,243 
Plus: Stock-based compensation 7,418 8,439 30,090 26,961 
Plus: Intangible asset amortization 1,364 399 3,725 742 
Plus: Cash acquisition-related expense (1) 1,099 93 3,025 93 
Non-GAAP Income from operations $ 22,824 $ 18,660 $ 87,201 $ 65,039 
GAAP Net income $ 14,400 $ 2,857 $ 57,304 $ 40,440 
Plus: Stock-based compensation 7,418 8,439 30,090 26,961 
Plus: Intangible asset amortization 1,364 399 3,725 742 
Plus: Cash acquisition-related expense (1) 1,099 93 3,025 93 
Less: Tax adjustment (2,945) 1,244 (20,739) (24,573) 
Non-GAAP Net income $ 21,336_ $ 13,032_ $ 73,405 $ 43,663 
Non-GAAP Net income per share: 
Basic $ 0.54 $ 0.34 $ 1.89 $ 1.17 
Diluted $ 0.51 $ 0.32 $ 1.75 $ 1.09 
Weighted average shares used in non-GAAP net income per share: 
Basic 39,200 38,278 38,876 37,443 
Diluted 41,580 41,186 41,897 40,071 


Note (1): Relates to compensation expense from the acquisition of NetWatcher and Layered Insight. 


Qualys, Inc. 
RECONCILIATION OF NON-GAAP DISCLOSURES 
FREE CASH FLOWS 
(Unaudited) 
(in thousands) 


Year Ended December 31, 


2018 2017 
GAAP Cash flows provided by operating activities (1) $ 125,464 $ 107,646 
Less: 
Purchases of property and equipment (22,775) (37,818) 
Principal payments under capital lease obligations (1,617) — 
Non-GAAP Free cash flows $ 101,072 $ 69,828 


Note (1): Includes $2.0 million of compensation paid during the year ended 2018 related to acquired assets. 


Qualys, Inc. 

RECONCILIATION OF NON-GAAP DISCLOSURES 
CALCULATED CURRENT BILLINGS 
(Unaudited) 

(in thousands) 


Three Months Ended December 31, 


2018 2017 
Q4 GAAP Revenue $ 74,200 $ 62,915 
Plus: Current Deferred Revenue at December 31 164,624 143,186 
Less: Current Deferred Revenue at September 30 (155,115) (132,167) 
Non-GAAP Q4 Calculated Current Billings $ 83,709 $ 73,934 


Calculated Current Billings Growth Compared to Same Period of Prior Year 13% 27% 


